The order of the group of points on the curve \(\mathcal E\)
is \(|\mathcal E| = 8\ell \), so its structure is \( \mathcal
E = \mathcal E[8] \times \mathcal E[\ell]\). The torsion
subgroup \( \mathcal E[8] \) consists of eight points of small
order. Technically, all of \(\mathcal E\) is torsion, but we
use the word only to refer to the small \(\mathcal E[8]\) part, not
the large prime-order \(\mathcal E[\ell]\) part.

To test if a point is in \( \mathcal E[8] \), use
EdwardsPoint::is_small_order().

To test if a point is in \( \mathcal E[\ell] \), use
EdwardsPoint::is_torsion_free().

The Edwards arithmetic is implemented using the “extended twisted
coordinates” of Hisil, Wong, Carter, and Dawson, and the
corresponding complete formulas. For more details,
see the curve_models submodule
of the internal documentation.

There is no function for checking whether a point is valid.
Instead, the EdwardsPoint struct is guaranteed to hold a valid
point on the curve.

We use the Rust type system to make invalid points
unrepresentable: EdwardsPoint objects can only be created via
successful decompression of a compressed point, or else by
operations on other (valid) EdwardsPoints.